On Wed, May 28, 2008 at 11:08 PM, Barry Shein [EMAIL PROTECTED] wrote:
I am a big, big fan of assessing charges for AUP abuse and making some
realistic attempt to try to make sure it's collectible, and otherwise
make some attempt to know who you're doing business with.
Just out of curiosity,
Dorn Hetzel wrote:
There is a really huge difference in the ease with which payment from a
credit card can be reversed if fraudulent, and the amount of effort
necessary to reverse a wire transfer. I won't go so far as to say that
reversing a wire transfer is impossible, but I would claim it's
The financial services world felt the same pre-9/11. Since then FINRA and SEC
regulations enforce Know Your Customer rules that require extensive record
keeping. The regulations now are quite burdensome. Given that usage of cloud
resources could be used for DDOS and other illegal activities, I
The conversation shifted to breaking MD5 because it was mentioned that one
way to prevent the installation of cracked IOS images was to include some
sort of DRM or trusted computing chip in new hardware, and have Cisco sign
their IOS images (supposedly even the boot EEPROM). This wouldn't be DRM
Oh, come on... Businesses buy services every day that have to be paid for
by methods like wire transfer. We're not talking about making it the only
payment method, just the method for deposits for risky services. I wonder
what percentage of Amazon E2C customers even want outbound port 25 access
Yeah, there was a day when anyone could buy a pickup truck full of ammonium
nitrate fertilizer from a random feed store and not attract any attention at
all, now, maybe not. Just like port 25, it has plenty of legitimate uses,
and some more problematic ones.
On Thu, May 29, 2008 at 9:14 AM,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Thu, 29 May 2008, Fred Reimer wrote:
plaintext (the IOS code) and the hash. It is not trivial to be able to
make changes in the code and maintain the same hash value, but there has
been at least limited success in doing so.
Has there? My
On Thu, 29 May 2008 09:18:07 -0400
Fred Reimer [EMAIL PROTECTED] wrote:
So the only easy way to attack this is the MD5 hash. We have a know
plaintext (the IOS code) and the hash. It is not trivial to be able
to make changes in the code and maintain the same hash value, but
there has been
Dorn Hetzel wrote:
Yeah, there was a day when anyone could buy a pickup truck full of
ammonium nitrate fertilizer from a random feed store and not attract any
attention at all, now, maybe not. Just like port 25, it has plenty of
legitimate uses, and some more problematic ones.
Equating port
On May 29, 2008, at 9:37 AM, Jim Wise wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Thu, 29 May 2008, Fred Reimer wrote:
plaintext (the IOS code) and the hash. It is not trivial to be
able to
make changes in the code and maintain the same hash value, but
there has
been at
This is not a crypto form, so we shouldn't get deep into the MD5 collision
debate, but I didn't say HOW there has been limited success. Sorry if the
wording of my message was not clear and implied that all you would need were
the plaintext and the hash.
Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS
The code would presumably be run upon boot from a non-flashable source,
which would run the boot ROM code through a check on the crypto chip and
only execute it if it passed. You would not put the code that checks the
boot ROM on the boot ROM. The new crypto chip would presumably have the
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Thu, 29 May 2008, Fred Reimer wrote:
The code would presumably be run upon boot from a non-flashable source,
which would run the boot ROM code through a check on the crypto chip and
only execute it if it passed. You would not put the code that
On May 28, 2008 at 23:53 [EMAIL PROTECTED] (Peter Beckman) wrote:
Getting someone to fax their ID in takes extra time and resources, and
means it might be hours before you get your account approved, and for
some service providers, part of the value of the service is the immediacy
On May 29, 2008 at 09:07 [EMAIL PROTECTED] (Al Iverson) wrote:
On Wed, May 28, 2008 at 11:08 PM, Barry Shein [EMAIL PROTECTED] wrote:
I am a big, big fan of assessing charges for AUP abuse and making some
realistic attempt to try to make sure it's collectible, and otherwise
make
On May 29, 2008 at 06:46 [EMAIL PROTECTED] (Joel Jaeggli) wrote:
Dorn Hetzel wrote:
Yeah, there was a day when anyone could buy a pickup truck full of
ammonium nitrate fertilizer from a random feed store and not attract any
attention at all, now, maybe not. Just like port 25, it has
Peter Beckman [EMAIL PROTECTED] writes:
If you are taking card-not-present credit card transactions over the
...snip hard to charge fradulent customers and also verifying customer
identity annoys the customer... points-
The goal here is to give abuse a negative expected return.
One way to
Barry Shein wrote:
On May 29, 2008 at 06:46 [EMAIL PROTECTED] (Joel Jaeggli) wrote:
Dorn Hetzel wrote:
Yeah, there was a day when anyone could buy a pickup truck full of
ammonium nitrate fertilizer from a random feed store and not attract any
attention at all, now, maybe not. Just
On Thu, 29 May 2008, Luke S Crawford wrote:
Peter Beckman [EMAIL PROTECTED] writes:
If you are taking card-not-present credit card transactions over the
...snip hard to charge fradulent customers and also verifying customer
identity annoys the customer... points-
The goal here is to give
What I really, really, (really), don't understand is what is this
perverse urge to argue incessantly that spam and related do little or
no harm, are of little consequence, and nothing can be done about it
anyhow? You'd think we were discussing ways to prevent hurricanes (and
some won't even
Forwarding this email on behalf of APNIC...
New IPv4 allocation for APNIC (112/8 and 113/8)
Dear colleagues
The information in this announcement is
In article
[EMAIL PROTECTED]
.net, [EMAIL PROTECTED] writes
The official spokespeople don't mention it, but there is also
a tendency for local officials to divert fuel delivery trucks
for their use instead of maintaining communication facilities.
How much fuel can you legally carry in drums
Peter Beckman [EMAIL PROTECTED] writes:
...snip use snort suggestion
This is what I think we should ALL be doing -- monitoring our own network
to make sure we aren't the source, via customers, of the spam or DOS
attacks. All outbound email from your own network should be scanned by
Barry Shein wrote:
What I really, really, (really), don't understand is what is this
perverse urge to argue incessantly that spam and related do little or
no harm, are of little consequence, and nothing can be done about it
anyhow? You'd think we were discussing ways to prevent hurricanes (and
Dear NANOG Community--
We are looking forward to seeing those who plan to attend NANOG43 at the
New York Marriott at the Brooklyn Bridge in Brooklyn on Sunday.
We expect excellent attendance, with almost 400 registered attendees to
date.
Some important highlights for those still considering
Link change?
http://www.ietf.org/internet-drafts/draft-iana-rfc3330bis-02.txt
On Wed, May 28, 2008 at 3:12 PM, Sean Donelan [EMAIL PROTECTED] wrote:
http://www.ietf.org/internet-drafts/draft-iana-rfc3330bis-01.txt
Other than a formatting error in the header (IPv4 Multicast Guidelines)
I'm getting connection refused from Comcast's POP3
servers, mail.comcast.net. Related to this?
http://www.theregister.co.uk/2008/05/29/comcast_domain_hijacked/
Oh, NetSol... Comcast Let the finger pointing begin.
--
Crist J. Clark
[EMAIL PROTECTED]
The header was corrected an hour or so after my original message, and
a revised internet-draft (02) was published.
On Thu, 29 May 2008, Jonathan Heinlein wrote:
Link change?
http://www.ietf.org/internet-drafts/draft-iana-rfc3330bis-02.txt
On Wed, May 28, 2008 at 3:12 PM, Sean Donelan
On 27 May 2008, at 22:18, Sean Donelan wrote:
The official spokespeople don't mention it, but there is also a
tendency for local officials to divert fuel delivery trucks for
their use instead
of maintaining communication facilities.
Some years ago we managed to get the UK government
On 27 May 2008, at 16:33, Robert Bonomi wrote:
From [EMAIL PROTECTED] Mon May 26 21:16:58 2008
Date: Tue, 27 May 2008 07:46:26 +0530
From: Suresh Ramasubramanian [EMAIL PROTECTED]
To: Colin Alston [EMAIL PROTECTED]
Subject: Re: amazonaws.com?
Cc: [EMAIL PROTECTED]
On Tue, May 27, 2008 at
[EMAIL PROTECTED] (Ian Mason) writes:
On 27 May 2008, at 16:33, Robert Bonomi wrote:
Amazon _might_ 'get a clue' if enough providers walled off the EC2
space, and they found difficulty selling cycles to people who couldn't
access the machines to set up their compute applications.
This
Hi,
Another case of getting much better help via NANOG than through a NOC.
Turns out there was an issue, and it subsequently was fixed in a
relatively small timeframe. Atleast a /20 of RR was not visible inside of L3,
I'm not sure if it was more.
Thanks again to those
32 matches
Mail list logo
